Protocol‑HTTP2 versions before 1.14 for Perl allow an attacker to exhaust server memory by repeatedly opening and closing HTTP/2 streams. When a stream enters the CLOSED state the module clears most of the stream’s keys but retains the entry in the connection stream table. Because stream identifiers strictly increase, each closed stream leaves a residual table entry that persists for the lifetime of the connection, allowing an attacker to accumulate tens of thousands of entries and grow memory usage linearly, as measured at roughly 920 bytes per closed stream.

This vulnerability affects the Perl module Protocol::HTTP2, any version earlier than 1.14. Deployments using this module to handle HTTP/2 connections, whether as a server or client, are susceptible.

The lack of a reported EPSS score and absence from the CISA KEV catalogue suggest that the exploitation likelihood is not currently quantifiable, but the vulnerability can be leveraged remotely over the network by an attacker who can send many HTTP/2 streams to a target server. The impact is high memory consumption that could bring a service down, but successful exploitation requires sustained traffic and a vulnerable server configuration. No CVSS score is provided, so severity must be judged on the potential for denial of service and resource exhaustion.